From Source Code to Network Profile: Automated and Traceable MUD Profile Generation for IoT Devices
Abstract Overview
The paper presents AutoMUD, a source-code-driven system for generating Manufacturer Usage Description (MUD) profiles for IoT devices from firmware and software source trees. Rather than relying on observed traffic, AutoMUD combines lightweight static and syntactic extraction, retrieval-grounded language-model reasoning, and deterministic validation to recover implemented communication behavior and compile eligible findings into a MUD file. The method is designed to preserve provenance, linking each generated rule to source-level evidence while retaining excluded or unresolved findings with explicit reasons for review. In evaluation on a Linux-based repository containing curl, wget, and OpenSSH components, the system recovered the benchmarked networking artifacts and produced a structurally valid policy matching the manually constructed reference.
Novelty
The distinctive contribution is automated MUD profile synthesis directly from source code, incorporating explicit source-to-rule traceability and conservative handling of uncertain or non-representable behaviors. This differs from prior traffic-based generation by analyzing implemented capabilities—including conditional or rarely exercised communication paths—prior to device deployment.
Results
On the evaluated repository, AutoMUD recovered all 31 ground-truth networking symbols, consolidated them into 23 source-validated endpoint groups, and generated 92/92 reference ACEs in a structurally valid MUD profile. In a controlled semantic fault-injection campaign across five scenarios, the generated traceability artifacts enabled detection, localization, explanation, and correction of all 24 injected erroneous ACEs, restoring the clean 92-ACE policy without altering unaffected rules.
Key Points
- AutoMUD derives MUD policies from source evidence instead of traffic traces, exposing implemented communication paths that may be rare, conditional, or difficult to observe at runtime.
- The pipeline maintains end-to-end accountability by linking every emitted access control entry to supporting source evidence and recording explicit reasons for excluded candidate endpoints.
- Experimental evaluation confirms complete recovery on a multi-application benchmark and demonstrates that the traceability artifacts enable auditing and correction of semantic policy errors.